PENSKE AUTOMOTIVE GROUP INC

Current report

Item 1A. Risk Factors

Current report

General Risks

Current report

We rely on third parties for the majority of our information systems and the availability and efficient operation of such systems are critical to the operation of our business.

Current report

Our information systems are fully integrated into our operations, and we rely on them to operate effectively, including with respect to electronic interfaces with manufacturers and other vendors, customer relationship management, sales and service efforts, data storage, and financial and operational reporting. The majority of our systems are provided by or licensed from third-party vendors and suppliers; the most significant of which are the dealer management systems (“DMS”) used across our retail operations and which are provided by a limited number of suppliers. We also rely on third-party vendors to supply other key products and services to us and our customers. One or more of these third-party vendors or suppliers may experience financial distress, technology challenges, cybersecurity incidents, ransomware demands, programming errors, staffing shortages or liquidity challenges, file for bankruptcy protection, go out of business, or suffer other disruptions in their business, each of which could affect the vendors’ ability to provide services to us and our customers. If any of our vendors or suppliers fail to deliver their products or services for any reason, our business and results of operations and financial condition could be adversely impacted, and such failures may lead to broader disruptions or failures across our information systems which may expose us to customer, employee, manufacturing partner or third-party claims or other legal liabilities.

Current report

The failure of our information systems, the failure to protect the integrity of these systems, or the interruption of these systems as discussed herein or otherwise due to natural disasters, power loss, unexpected termination of our agreements, cyber-attacks, ransomware encryptions, or other reasons such as those which resulted from the CDK Cybersecurity Incident (described below), could significantly and adversely disrupt our business operations, impact our sales, service, inventory, customer relationship management, and accounting functions and otherwise adversely affect our results of operations. For example, on June 19, 2024, we became aware that CDK Global, LLC (“CDK”), a third-party provider of information systems, including DMS software to support retail automotive and commercial truck dealership operations, was experiencing a cybersecurity incident and its systems were rendered inoperable (the “CDK Cybersecurity Incident”). Although we do not utilize CDK's DMS in our U.S. or international automotive dealership operations, our Premier Truck Group business does utilize CDK’s dealer management system and was impacted by the CDK Cybersecurity Incident. In response to the CDK Cybersecurity Incident, we immediately took precautionary containment steps to protect our systems and commenced an investigation of the incident. PTG implemented its business continuity response plans and continued to operate without the DMS at all locations through manual or alternate processes developed to respond to such incidents. On July 2, PTG was able to reconnect all of its locations to CDK’s DMS servers and restore core functionality of the software platform.

Current report

Even where business continuity responses and contingency plans, such as those noted above, are implemented to minimize disruptions caused by information systems failures, such mitigation efforts may result in decreased operational efficiencies and limit dealership productivity. Further, despite our efforts to assess, identify, and manage material risks from cybersecurity threats to our business and operations, including through evaluating key partners and third parties with whom we share our information as well as certain customer and employee information, we may not be able to protect our various systems from disruptions.

Current report

Cybersecurity. In the ordinary course of our business, we receive confidential information about our customers, employees, associates, and vendors. We collect, process, retain, and in some cases share this information in the normal course of our business, and such information is collected and stored primarily in our core information systems, including our DMS platforms. Our internal and third-party systems, including our DMS and customer relationship management systems, are under a heightened level of risk from state actors, cyber criminals or other individuals with malicious intent to gain unauthorized access to our systems and exploit the information, including the confidential information of our customers and employees, that we gather. Cyber-attacks, such as the CDK Cybersecurity Incident described above, and threats to information systems and network and data security are becoming increasingly diverse and sophisticated, with attacks increasing in frequency, scope, and potential harm. In addition, some of our software applications are utilized by third parties who, in turn, subcontract or otherwise outsource various processes and administrative functions to additional third parties. Such third parties may have access to confidential information that is critical to our business operations and services. While our information security program includes enhanced controls to monitor third party providers' security programs, these third parties are subject to their own risks of data breaches, cyber-attacks, and other events or actions that could damage, disrupt, or close down their networks or systems, which in turn may adversely impact our business operations.

Current report

Despite the security measures we have in place or may implement in the future, we may be unable to fully detect, mitigate, or protect against cyber-attacks, ransomware attacks, computer viruses, security breaches, social engineering, malicious software, lost or misplaced data, programming errors, human errors, burglary, acts of vandalism, misdirected wire transfers or other events impacting us or our third-party service providers. Any security breach or event, whether by us directly or our third-party service providers, may result in an authorized party obtaining trade secrets, personally identifiable information or confidential information and may result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer, vendor or manufacturer relationships, and have other negative operational impacts. In addition, such security breaches or events resulting in the loss or exposure of this information could result in liabilities and other significant financial exposures, including those derived from investigations, regulatory fines, penalties for violations of applicable laws and regulations, costs related to the remediation of ransomware events, litigation including consumer class actions, the imposition of penalties, or other means, any of which could have a material adverse effect on our business, results of operations or financial condition. In addition, our failure to respond quickly and appropriately to such a security breach, or our failure to adequately test and verify the remediation of security incidents involving third parties prior to reintegration into our information systems, could exacerbate the consequences of the breach.

Previous report

Adverse conditions affecting one or more significant automotive manufacturers or suppliers will affect us. Our success depends on the overall success of the automotive industry generally and in particular, on the success of the brands of vehicles that each of our dealerships sell. In 2023, revenue generated at our BMW/MINI, Audi/Volkswagen/Porsche/Bentley, Toyota/Lexus, and Mercedes-Benz/Sprinter/smart dealerships represented 26%, 22%, 13%, and 9%, respectively, or 70% in aggregate, of our total automotive dealership revenues. In addition, our retail commercial truck operations rely principally on Freightliner and Western Star trucks (both Daimler brands).

Previous report

Significant adverse geo-political events, weather-related events, supply chain issues, or other events that interrupt vehicle or parts supply to our dealerships would likely have a significant and adverse impact on the industry as a whole, including us, particularly if the events impact any of the manufacturers whose franchises generate a significant percentage of our revenue. In the first quarter of 2024, vehicle shipments of certain brands were delayed as a sub-component was determined to be violative of certain legal requirements relating to its place of origin. In March 2024, a cargo ship crashed into the Francis Scott Key Bridge in the Port of Baltimore resulting in closure of that port, which was the largest U.S. port by volume for deliveries of automotive vehicles and components. In April 2024, a Freightliner truck supplier experienced a fire at its facility. These events affected the timing of new vehicles deliveries to our dealerships and similar events may materially and adversely affect us.

Previous report

Other events such as a pandemic and the war in Ukraine may impact the supply of vehicles or parts to the markets in which we operate, and our business could be materially adversely affected. The supply chain required to manufacture and supply parts for the vehicles we sell is highly complex and integrated. Any failure of that supply chain could materially and adversely affect us. Our new vehicle days' supply is 40 as of March 31, 2024, compared to 39 as of December 31, 2023. While we expect to continue to have normal levels of used vehicles for sale (our used vehicle days' supply is 36 as of March 31, 2024, compared to 48 as of December 31, 2023), the lower supply of new vehicles has contributed to higher vehicle gross profit on new vehicles sold, which contributed to our higher overall profitability in recent years. While we expect increased new vehicle availability, continued production disruptions and supply shortages could result in suppressed new and used vehicle sales volumes which would impact the availability and affordability of new and used vehicles and may adversely affect us. As the supply of new vehicles has improved, we have experienced, and may continue to experience, reduced new and used vehicle gross profit together with higher sales volumes.

Previous report

Additional risks relating to PTS. PTS' business has additional risks to those in the retail business, including:

Previous report

Regulatory Requirements and Vehicle Mandates. Increasing efforts to control emissions of carbon dioxide and certain other gases, referred to as greenhouse gases (“GHGs”), are likely to have an effect on PTS' (and PTG's) business and results of operations. In particular, President Biden and Congressional leaders, as well as California, New Jersey, and other states, have expressed support for policies limiting GHG emissions from vehicles through new regulations that require moving to zero-emission formats and/or the implementation of more stringent emissions controls. For example, original equipment manufacturers may be required to install additional engine components, additional aerodynamic features, or low-rolling resistance tires to comply with fuel economy regulations, which may result in higher costs associated with more complex components and a shorter useful tread life for tires, increasing operating costs for customers, suppliers, and PTS. Additionally, the Advanced Clean Trucks rule, as adopted by the California Air Resources Board ("CARB") and several other states, will require that certain truck manufacturers sell zero-emission trucks as an increasing percentage of their annual sales in these states from 2024 to 2035 (and likely beyond). Furthermore, the Advanced Clean Fleet rule, issued by CARB in April 2023, and which may be adopted in other jurisdictions, will require certain larger fleets, including PTS', to purchase zero-emission trucks to comprise an increasing percentage of their fleets from 2025 to 2042. On December 28, 2023, CARB announced that it would defer enforcement of the rule, which was scheduled to become effective on January 1, 2024, while its request for a waiver from the EPA to authorize the rule is pending.

Previous report

On March 29, 2024, the U.S. Environmental Protection Agency ("EPA") announced its Phase 3 Rule regarding GHG emissions standards for heavy duty vehicles which, along with EPA’s other rules, requires market shifts to zero-emission technologies in certain segments of the heavy-duty vehicle sector and new, more stringent GHG emissions standards for heavy-duty engines and vehicles beginning as soon as model year 2027. The EPA initiated the first phase of the Clean Trucks Plan by issuing a final rule on December 20, 2022, which focuses on reducing emissions that form smog and soot and will apply to heavy-duty engines and vehicles beginning in model year 2027 through 2032. The Phase 3 Rule requires significant reductions in truck emissions through 2032 which may require the development of a significant volume of zero emission vehicles ("ZEV"). The current level of ZEV commercial vehicle sales is below 1%. In addition, foreign, federal, state, provincial, and local lawmakers also are considering a variety of other climate change proposals, including prohibiting the use of certain substances with high “global warming potential.” These and any other future requirements could result in higher prices for vehicles, diesel engines, materials, and fuel, as well as higher maintenance costs and uncertainty as to reliability and range of the new engines. Any of these factors could increase operating costs in the transportation industry, which would directly affect PTS' and PTG's customers and could reduce demand for vehicles. The new technology and legal requirements may also affect the resale values of these vehicles when PTS or PTG attempts to sell them in the future.

Previous report

Regulatory Issues. We are subject to a wide variety of regulatory activities and oversight, including:

Previous report

Vehicle requirements. Federal and state governments and regulators in both our domestic and international markets have increasingly placed restrictions and limitations on the vehicles sold in the market in an effort to combat perceived negative environmental effects. For example, in the U.S., automotive manufacturers are subject to federally mandated corporate average fuel economy standards, which will increase substantially through 2026. Moreover, on March 20, 2024, the EPA issued new emissions limits for light-duty and medium-duty model year 2027 through 2023 vehicles which are significantly more restrictive than existing requirements which are designed to incent an increased adoption of electric vehicles. For example, GHG emission in light-duty vehicles are required to decrease 49% for model year 2032 as compared to model year 2026. Moreover, the EPA is requiring electric batteries and related components to have at least an 8-year, 80,000-mile warranty.

Previous report

Representatives of the U.K. government have proposed a ban on the sale of gasoline engines and gasoline hybrid engines in new cars and new vans that would take effect in 2035 while also providing government incentives on certain electric vehicles to entice consumers to transition from internal combustion vehicles to electric vehicles. The European Parliament recently approved a law requiring most automakers to reduce the emissions of new cars sold by 55% in 2030 and achieve a zero carbon-emission standard by 2035, effectively banning the sale of new gasoline and diesel cars and vans by 2035. Similar legislation in various states across the United States would ban the sale of new vehicles with gasoline-only engines in cars as early as 2035. The California legislation requires 35% of all new vehicles sold to meet a zero emissions standard by 2026 (with certain allowances for hybrid gas/electric vehicles), which percentage requirement increases until 2035, after which 100% of new vehicles sold must comply. Significant increases in fuel economy requirements, the new battery warranty standards, and new restrictions on emissions on vehicles and fuels could adversely affect prices, availability, and demand for the vehicles that we sell, which could materially adversely affect us.

Previous report

Commercial trucks are subject to similar regulatory risks related to emissions standards and other regulatory requirements discussed above. The EPA has also recently issued revised standards to reduce GHG emissions from heavy-duty vehicles beginning in model year 2027 which is also discussed above. PTG sells new and used heavy- and medium-duty commercial trucks, parts and service, and offers collision repair services. PTS, with its broad product offering including full-service truck leasing, contract maintenance, and truck rental, along with logistics services, is one of the largest purchasers of commercial trucks in North America. Should future regulations or consumer sentiment hinder our or PTS' ability to maintain, acquire, sell, or operate trucks, we may be adversely affected.